Set up your own VPN

Start to finish: stand up a WireGuard server on a box you control, add your devices, and connect. Budget about ten minutes. You need a server with a public IP (any cheap VPS) and root on it.

1 · Stand up the server

The fast way — copy the installer onto a fresh VPS and run it as root. It installs WireGuard, enables forwarding and NAT, generates the server keys, opens the firewall port, and starts the tunnel on boot. 

curl -fsSL https://domainless.fun/vpn/wg-setup.sh -o wg-setup.sh
# read it first — never pipe a script straight into a root shell
less wg-setup.sh
sudo bash wg-setup.sh

It prints your server public key and endpoint (your.ip:51820) at the end — you'll hand those to each device. Every line of the script is on the code page; read it before you run it.

Prefer to do it by hand?

The whole thing is five commands and one file. On Debian/Ubuntu:

# 1. install
sudo apt update && sudo apt install -y wireguard qrencode

# 2. turn on IP forwarding (persists across reboot)
echo 'net.ipv4.ip_forward = 1' | sudo tee /etc/sysctl.d/99-wg.conf
sudo sysctl --system

# 3. generate the server keypair
umask 077
wg genkey | sudo tee /etc/wireguard/server.key | wg pubkey | sudo tee /etc/wireguard/server.pub

# 4. write /etc/wireguard/wg0.conf  (template below)

# 5. start it, now and on every boot
sudo systemctl enable --now wg-quick@wg0
sudo wg show   # confirm it's listening

Your /etc/wireguard/wg0.conf — swap eth0 for your internet-facing interface (ip route show default tells you which): 

[Interface]
Address = 10.7.0.1/24
ListenPort = 51820
PrivateKey = <contents of /etc/wireguard/server.key>
PostUp   = iptables -t nat -A POSTROUTING -s 10.7.0.0/24 -o eth0 -j MASQUERADE; iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT
PostDown = iptables -t nat -D POSTROUTING -s 10.7.0.0/24 -o eth0 -j MASQUERADE; iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -j ACCEPT

Open the port

WireGuard listens on udp/51820. If your host has a cloud firewall or security group (most do), allow that port there too — not just in the box's own firewall — or nothing will connect.

2 · Add a device

Each phone or laptop is a "peer." The helper generates its keypair, reserves the next address, wires it into the running server with no downtime, and prints a ready config plus a QR code for phones: 

curl -fsSL https://domainless.fun/vpn/wg-add-client.sh -o wg-add-client.sh
sudo bash wg-add-client.sh phone     # then: laptop, tablet, …

Rather not touch the server for this? The in-browser config builder makes a client keypair locally — the private key never leaves your device — and assembles the .conf from your server's public key and endpoint. You just paste the one [Peer] block it gives you into the server's wg0.conf.

Either way, a client config looks like this — it's the whole secret, so keep it private: 

[Interface]
PrivateKey = <this device's private key>
Address = 10.7.0.2/32
DNS = 1.1.1.1

[Peer]
PublicKey = <your server's public key>
Endpoint = your.server.ip:51820
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25

3 · Import it and connect

Install the official WireGuard app, import the .conf (or scan the QR), and flip the switch. Pick your platform:

  1. Install WireGuard for Windows (or from the Microsoft Store).
  2. Open WireGuard → Add Tunnel → Import tunnel(s) from file, and pick your .conf.
  3. Select the tunnel and click Activate.
  4. Check your IP at a site like ipleak.net — it should show your server, not your ISP.

Split tunnel vs. everything

The config above routes all traffic through the tunnel (AllowedIPs = 0.0.0.0/0, ::/0). To only reach the private network — leaving normal browsing on your own connection — change that line to AllowedIPs = 10.7.0.0/24 before importing.

Kill switch

On desktop WireGuard, enable "Block untunneled traffic (kill-switch)" in the tunnel's settings so nothing leaks if the tunnel drops. On mobile, enable "Always-on VPN" in the OS VPN settings.